Privacy Pools ZK 驗證合約實作

這篇教你如何在 Solidity 中實現 ZK 證明驗證合約。

Groth16 驗證合約

contract Groth16Verifier {
    // 驗證金鑰
    uint256 constant IC0x = 0x...;
    uint256 constant IC0y = 0x...;
    
    // 配對檢查
    function pairingCheck(
        uint256[2] memory a,
        uint256[2][2] memory b,
        uint256[2] memory c,
        uint256[] memory input
    ) public view returns (bool) {
        // 實現配對驗證邏輯
        return _verify(a, b, c, input);
    }
}

Privacy Pools 核心合約

contract PrivacyPool {
    // Merkle 樹根
    bytes32 public commitmentTreeRoot;
    
    // 已使用的 nullifier
    mapping(bytes32 => bool) public nullifiers;
    
    // 存款
    function deposit(bytes32 _commitment) external payable {
        require(!commitments[_commitment]);
        commitments[_commitment] = true;
        emit Deposit(_commitment, leafIndex++);
    }
    
    // 取款
    function withdraw(
        bytes calldata _proof,
        bytes32 _root,
        bytes32 _nullifier,
        address payable _recipient
    ) external {
        require(!nullifiers[_nullifier]);
        require(isKnownRoot(_root));
        require(verifier.verifyProof(_proof, _root, _nullifier));
        
        nullifiers[_nullifier] = true;
        _recipient.transfer(address(this).balance);
    }
}

完整實作

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;

import "@openzeppelin/contracts/security/ReentrancyGuard.sol";

contract PrivacyPool is ReentrancyGuard {
    mapping(bytes32 => bool) public commitments;
    mapping(bytes32 => bool) public nullifiers;
    
    IVerifier public verifier;
    
    event Deposit(bytes32 indexed commitment);
    event Withdrawal(bytes32 indexed nullifier);
    
    function deposit(bytes32 _commitment) external {
        require(!commitments[_commitment]);
        commitments[_commitment] = true;
        emit Deposit(_commitment);
    }
    
    function withdraw(
        bytes calldata _proof,
        bytes32 _root,
        bytes32 _nullifier,
        address payable _recipient
    ) external nonReentrant {
        require(!nullifiers[_nullifier]);
        require(isKnownRoot(_root));
        require(verifier.verifyProof(_proof, _root, _nullifier));
        
        nullifiers[_nullifier] = true;
        payable(_recipient).transfer(msg.value);
        emit Withdrawal(_nullifier);
    }
}

結語

Solidity 實現 ZK 驗證合約的關鍵是理解配對運算和驗證方程。搞懂這個，你就能部署自己的隱私合約。

COMMIT: Add Privacy Pools ZK verification Solidity implementation guide